[PATCH] HID: bpf: reject oversized device events before copying

[Mark Amirkan via B4 Relay]

From: Mark Amirkan <markdamirkan@xxxxxxxxx>

HID-BPF allocates its device-event buffer from the largest report in the
device's parsed report descriptor.  dispatch_hid_bpf_device_event() then
copies the transport-provided report into that buffer before checking its
size.

An input report larger than the allocated event buffer therefore causes
a heap out-of-bounds write when a device-event program is attached.  The
later check of the BPF program's return value cannot prevent the initial
copy.

Reject reports that exceed either the transport buffer or the persistent
HID-BPF event buffer before clearing or copying the data.

With a 64-byte event allocation, a same-file KUnit test produced a
one-byte KASAN out-of-bounds write for a 65-byte report in three runs.
The 64-byte boundary remained clean.  After this change, both cases were
clean in three runs and the oversized report returned -EINVAL.  The test
exercised the production dispatch function but not the complete UHID and
BPF attachment path.

Fixes: 658ee5a64fcf ("HID: bpf: allocate data memory for device_event BPF programs")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM Symbolic
Signed-off-by: Mark Amirkan <markdamirkan@xxxxxxxxx>
---
 drivers/hid/bpf/hid_bpf_dispatch.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/bpf/hid_bpf_dispatch.c b/drivers/hid/bpf/hid_bpf_dispatch.c
index 536f6d01fd..06ba833eb9 100644
--- a/drivers/hid/bpf/hid_bpf_dispatch.c
+++ b/drivers/hid/bpf/hid_bpf_dispatch.c
@@ -50,6 +50,9 @@ dispatch_hid_bpf_device_event(struct hid_device *hdev, enum hid_report_type type
 	if (!hdev->bpf.device_data)
 		return data;
 
+	if (*size > *buf_size || *size > ctx_kern.ctx.allocated_size)
+		return ERR_PTR(-EINVAL);
+
 	memset(ctx_kern.data, 0, hdev->bpf.allocated_data);
 	memcpy(ctx_kern.data, data, *size);
 

---
base-commit: 9cdc7e6dc7a99ad7311ad5e7c145f2b9ce4e24b0
change-id: 20260913-b4-send-hid-bpf-event-bounds-4d0e8170ceb4

Best regards,
--  
Mark Amirkan <markdamirkan@xxxxxxxxx>